SPDX 2.3: What Changed in the SBOM Standard and What It Means for Your Program

What Is SPDX and Why It Matters

SPDX is one of the two dominant SBOM formats — the other being CycloneDX. It was originally developed for license compliance use cases and has the deepest support for SPDX license expression syntax, including complex multi-license scenarios. Since EO 14028 and NTIA guidance accepted SPDX as a compliant format, it has become the standard of choice for organizations with U.S. federal compliance obligations.

Key Changes in SPDX 2.3

SPDX 2.3 expanded support for Package URLs (PURLs) as a primary identifier field, making it easier to match SBOM components against vulnerability databases that use PURL-based indexing. Previous versions supported PURLs only as external references with less structured formatting. The 2.3 specification also improved support for snippet-level information, enabling more precise license attribution for files that contain code under multiple licenses.

A significant addition was improved support for relationships between SBOM documents — enabling organizations to compose SBOMs from multiple components and link them into a unified view of a complex system. This is especially important for container-based architectures where an application SBOM may reference separate OS layer and middleware SBOMs.

SPDX vs CycloneDX: Still Complementary

Many practitioners ask whether to use SPDX or CycloneDX. The answer in 2022 is: ideally both, but choose based on primary use case. SPDX excels at license compliance with its rich license expression syntax and long history in the open source community. CycloneDX excels at security use cases with native VEX support and a more developer-friendly JSON schema. Both are accepted by CISA, FDA, and all major regulators. Modern SCA tools can output both formats from a single scan.

Validating SPDX Output

The SPDX Tools project provides a validation library and command-line tool for verifying that SBOM files conform to the SPDX specification. Adding an SPDX validation step to your CI/CD pipeline ensures that generated SBOMs are syntactically correct before they are stored or submitted to customers or regulators. An invalid SBOM is worse than no SBOM — it gives false confidence while failing to provide actual security value.

What This Means for Your SBOM Program

If your SCA tool was last updated before 2022, verify that it supports SPDX 2.3 output. The PURL improvements in particular are significant for vulnerability matching quality — older SPDX output may have components that cannot be reliably matched against NVD or OSV. If your organization uses SPDX for FDA or federal compliance, confirm with your SCA vendor that their output meets the 2.3 specification.